sctp: fix association hangs due to off-by-one errors in sctp_tsnmap_grow()
authorLee A. Roberts <lee.roberts@hp.com>
Thu, 28 Feb 2013 04:37:27 +0000 (04:37 +0000)
committerDavid S. Miller <davem@davemloft.net>
Thu, 28 Feb 2013 20:34:26 +0000 (15:34 -0500)
commit70fc69bc5a54d9776ace7c99d46eb533f8fb6e89
tree8720e9ed3e8d91b80dac204d95cf81a3774ba43a
parent726bc6b092da4c093eb74d13c07184b18c1af0f1
sctp: fix association hangs due to off-by-one errors in sctp_tsnmap_grow()

In sctp_tsnmap_mark(), correct off-by-one error when calculating
size value for sctp_tsnmap_grow().

In sctp_tsnmap_grow(), correct off-by-one error when copying
and resizing the tsnmap.  If max_tsn_seen is in the LSB of the
word, this bit can be lost, causing the corresponding packet
to be transmitted again and to be entered as a duplicate into
the SCTP reassembly/ordering queues.  Change parameter name
from "gap" (zero-based index) to "size" (one-based) to enhance
code readability.

Signed-off-by: Lee A. Roberts <lee.roberts@hp.com>
Acked-by: Vlad Yasevich <vyasevich@gmail.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
net/sctp/tsnmap.c